esbuild — Greenflagged

An extremely fast JavaScript and CSS bundler and minifier.

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

esbuild

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require resolves package.json from __dirname — a fixed, safe path construction, not arbitrary module loading.	ai	2026/04/23
semgrep	semgrep:child-process-spawn	AI (semgrep): esbuild spawns its own binary as a long-lived service process — this is the core architecture of the package.	ai	2026/04/23
bogus-package	bogus-package	AI (bogus-package): esbuild is a major ecosystem tool; missing keywords and terse README are not spam signals for this package.	ai	2026/04/23
install-scripts	install-script:postinstall	AI (install-scripts): esbuild's postinstall runs node install.js to set up the platform-specific binary — documented, stable behavior across all versions.	ai	2026/04/23
semgrep	semgrep:env-spread	AI (semgrep): process.env spread in install.js is used to pass environment to npm subprocess while clearing npm_config_global — legitimate and auditable.	ai	2026/04/23
semgrep	semgrep:child-process-import	AI (semgrep): child_process is used in install.js to invoke npm for fallback binary installation — core to esbuild's install mechanism.	ai	2026/04/23

Versions (showing 15 of 15)

Version	Deps	Published
0.28.0	0 / 0	2026-04-02
0.27.5	0 / 0	2026-04-02
0.27.3	0 / 0	2026-02-05
0.27.0	0 / 0	2025-11-09
0.26.0	0 / 0	2025-11-09
0.25.11	0 / 0	2025-10-15
0.25.10	0 / 0	2025-09-17
0.25.9	0 / 0	2025-08-12
0.25.8	0 / 0	2025-07-19
0.25.7	0 / 0	2025-07-18
0.25.5	0 / 0	2025-05-27
0.25.4	0 / 0	2025-05-06
0.25.2	0 / 0	2025-03-30
0.25.1	0 / 0	2025-03-10
0.25.0	0 / 0	2025-02-08

v0.28.0

3 findings

HIGH Package has 'postinstall' script install-scripts

Script: node install.js

HIGH env-spread: install.js:181 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/evanw/esbuild/blob/6a794dff68e6a43539f6da671e3080efdf11ca70/install.js#L181 179 | } 180 | function installUsingNPM(pkg, subpath, binPath) { > 181 | const env = { ...process.env, npm_config_global: void 0 }; 182 | const esbuildLibDir = path2.dirname(require.resolve("esbuild")); 183 | const installDir = path2.join(esbuildLibDir, "npm-install");

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.27.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.27.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.27.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.26.0

2 findings

HIGH Publisher changed: evanw → GitHub Actions (on 2025-11-09) provenance

This version was published by a different npm account than previous versions on 2025-11-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.